Configuring NAT Security
NAT security can be implemented by setting the maximum number of NAT sessions that can be established and the rate at which the first packet is sent to create a flow for a specific user.
Usage Scenario
You can deploy the NAT security function to guarantee secure operations on a NAT device and prevent attacks.
Pre-configuration Tasks
Before configuring the NAT security function, complete the following task:
- Configure basic NAT functions.
- Configure NAT for traffic.
- Configuring a Limit on the Maximum Number of User-to-Network NAT Sessions
- Configuring a Limit on the Maximum Number of Network-to-User NAT Sessions
- Setting the Rate at Which Packets Are Sent to Create a Flow for a User
- Configuring the Rate Limit at Which the First Packet Is Sent to Create a Flow
- Verifying the NAT Security Configuration
Configuring a Limit on the Maximum Number of User-to-Network NAT Sessions
To prevent individual users from consuming excessive session table resources to cause failures to establish connections for other users, you can set a limit on the maximum number of user-to-network NAT sessions that can be established for a specific user.
Context
If the number of established Transmission Control Protocol (TCP), User Datagram Protocol (UDP), Internet Control Message Protocol (ICMP) NAT sessions, or the total number of NAT sessions involving the same source IP address exceeds a configured threshold, a device stops establishing such sessions. The limit helps prevent resource overconsumption from resulting in a failure to establish connections for other users.
Procedure
- Run system-view
The system view is displayed.
- Run nat instance instance-name [ id id ]
The NAT instance view is displayed.
- (Optional) Run nat session-limit enable
The user-based NAT session number limit function is enabled.
This function is enabled by default.
- Run nat session-limit { tcp | udp | icmp | total } session-number
The maximum number of NAT sessions that can be established is set.
- Run commit
The configuration is committed.
Configuring a Limit on the Maximum Number of Network-to-User NAT Sessions
To prevent individual users from consuming excessive session table resources to cause failures to establish connections for other users, you can set a limit on the maximum number of network-to-user NAT sessions that can be established for a specific user.
Context
If the number of established Transmission Control Protocol (TCP), User Datagram Protocol (UDP), Internet Control Message Protocol (ICMP) NAT sessions, or the total number of NAT sessions involving the same destination IP address exceeds a configured threshold, a device stops establishing such sessions. The limit helps prevent resource overconsumption from resulting in a failure to establish connections for other users.
Procedure
- Run system-view
The system view is displayed.
- Run nat instance instance-name [ id id ]
The NAT instance view is displayed.
- (Optional) Run nat reverse-session-limit enable
The device is enabled to monitor the number of established user-specific network-to-user NAT sessions.
This function is enabled by default.
- Run nat reverse-session-limit { tcp | udp | icmp | total } session-number
The maximum number of NAT sessions that can be established is set.
- Run commit
The configuration is committed.
Setting the Rate at Which Packets Are Sent to Create a Flow for a User
A device can be configured to dynamically detect the traffic forwarding rate and limit the rate at which packets are sent to create a flow for each user.
Context
A NAT device with a multi-core structure allows flow construction and forwarding processes to share CPU resources. To minimize or prevent NAT packet loss and a CPU usage increase, the device has to maintain a proper ratio of the forwarding rate to the flow creation rate.
Procedure
- Run system-view
The system view is displayed.
- Run nat instance instance-name [ id id ]
The NAT instance view is displayed.
- (Optional) Run nat user-session create-rate limit enable
The limit on the rate at which packets are sent to create a user flow is set.
- Perform either of the following operations:
- If the rate accuracy is low, run nat user-session create-rate rate
- If the rate accuracy is high, run nat user-session create-rate extended-range rate
If both the nat user-session create-rate extended-range and nat user-session create-rate commands are run, the latest configuration takes effect.
- Run commit
The configuration is committed.
Configuring the Rate Limit at Which the First Packet Is Sent to Create a Flow
Limiting the rate at which the first packet is sent to the CPU of a service board to create a flow prevents users from using a large number of CPU resources through first packet attack and thereby ensuring the forwarding of normal traffic.
Context
The NAT blacklist function defends a device against attacks initiated by sending network-side first packets with a specified set of a public IP address, a port number, and a protocol ID or to all IP addresses. If no internal service is configured or if public network traffic does not match entries in a session table on a NAT device, the NAT device considers traffic transmitting at a rate reaching a specified threshold as attack traffic. The NAT device adds the IP address and UDP or TCP destination port number of attack traffic to a NAT blacklist. Once network-side attack traffic matches the blacklist, the NAT device drops the traffic or collects statistics about the traffic.
- Address-level detection: An address-level rate threshold is set for a NAT device to detect attacks only on IP addresses.
- Port-level detection: A port-level rate threshold is set for a NAT device to detect attacks using packets with a specified IP address, a specified port number, and a specified protocol ID.
In VS mode, this configuration process is supported only by the admin VS.
Procedure
- Run system-view
The system view is displayed.
- Run nat flow-defend reverse-blacklist disable
The blacklist on a new flow from the public network to the private network is disabled.
- Run nat flow-defend { forward | fragment | reverse } rate rate-number slot slot-id
The rate at which the first packet is sent to the CPU of a service board to create a flow is set.
- Run nat flow-defend reverse-blacklist detect-threshold ip-port-level
high-threshold
The port-level rate threshold for generating entries in a reverse NAT blacklist is set.
- Run nat flow-defend reverse-blacklist detect-threshold ip-level
high-threshold
The address-level rate threshold for generating entries in a reverse NAT blacklist is set.
- Run commit
The configuration is committed.
Verifying the NAT Security Configuration
After configuring the NAT security functions, you can run display commands to check the configuration.
Procedure
- Run the display nat flow-defend { forward | reverse | fragment } rate [ slot slot-id ] command to check the configured rate at which the first packet is sent to create a flow for a user.
- Run the display nat user-information { cpe ipv4 ipv4-address | session-discard } [ slot slot-id ] [ verbose ] command to check NAT user information.
- Configuring a Limit on the Maximum Number of User-to-Network NAT Sessions
- Configuring a Limit on the Maximum Number of Network-to-User NAT Sessions
- Setting the Rate at Which Packets Are Sent to Create a Flow for a User
- Configuring the Rate Limit at Which the First Packet Is Sent to Create a Flow
- Verifying the NAT Security Configuration
